Page MenuHomePhabricator

Paramiko > 2.8.1 incompatibility with some Juniper devices
Closed, ResolvedPublic

Description

I upgraded the Homer dependencies which moved Paramiko to 2.9.2. Which prevents Homer to connect to some (older) devices.

['asw-a-codfw.mgmt.codfw.wmnet', 'asw-b-codfw.mgmt.codfw.wmnet', 'asw-c-codfw.mgmt.codfw.wmnet', 'asw-d-codfw.mgmt.codfw.wmnet', 'asw1-eqsin.mgmt.eqsin.wmnet', 'asw2-a-eqiad.mgmt.eqiad.wmnet', 'asw2-b-eqiad.mgmt.eqiad.wmnet', 'asw2-c-eqiad.mgmt.eqiad.wmnet', 'asw2-d-eqiad.mgmt.eqiad.wmnet', 'asw2-ulsfo.mgmt.ulsfo.wmnet', 'cr1-codfw.wikimedia.org', 'cr1-eqiad.wikimedia.org', 'cr2-codfw.wikimedia.org', 'cr2-eqiad.wikimedia.org', 'cr2-esams.wikimedia.org', 'cr3-esams.wikimedia.org', 'fasw-c-codfw.mgmt.codfw.wmnet', 'fasw-c-eqiad.mgmt.eqiad.wmnet', 'mr1-eqiad.wikimedia.org', 'mr1-eqsin.wikimedia.org', 'mr1-ulsfo.wikimedia.org', 'pfw3-codfw.wikimedia.org', 'pfw3-eqiad.wikimedia.org']

With error:

DEBUG:ncclient.transport.ssh:Finalizing pubkey algorithm for key of type 'ssh-rsa'
DEBUG:ncclient.transport.ssh:Our pubkey algorithm list: ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-rsa']
DEBUG:ncclient.transport.ssh:Server did not send a server-sig-algs list; defaulting to our first preferred algo ('rsa-sha2-512')
DEBUG:ncclient.transport.ssh:NOTE: you may use the 'disabled_algorithms' SSHClient/Transport init kwarg to disable that or other algorithms if your server does not support them!
INFO:ncclient.transport.ssh:Authentication (publickey) failed.

Upstream task is: https://github.com/paramiko/paramiko/issues/1961

As I'm not aware of a way to pass Paramiko parameters through junos-pyez, current workaround will be to force the Paramiko version to 2.8.1.

Longer term fix is T254013.

Event Timeline

ayounsi triaged this task as High priority.Jan 19 2022, 8:40 AM
ayounsi created this task.
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 755312 had a related patch set uploaded (by Ayounsi; author: Ayounsi):

[operations/software/homer@master] Force paramiko to 2.8.1

https://gerrit.wikimedia.org/r/755312

Change 755312 merged by Ayounsi:

[operations/software/homer@master] Force paramiko to 2.8.1

https://gerrit.wikimedia.org/r/755312

ayounsi claimed this task.

Workaround pushed.